Hey everyone, so, after lots of googeling and trying I'm turning to you guy's. My situation is that I have two Netgear R7000's running Tomato 1.40 Shibby (ARM) AIO buids.. My test setup is as following (later the other router is going to ship to another location): MODEM DHCP: 192.168.0.x Tomato-A: -WAN IP: 192.168.0.101 -LAN DHCP: 192.168.1.101-192.168.1.199 -OpenVPN server IP: 10.8.0.0 Server settings: -Push LAN to clients: yes -Direct clients to redirect Internet traffic: yes -Respond to DNS: yes -Advertise DNS to clients: yes -Cypher: AES-256-CBC -Compression: Adaptive -Manage Client-Specific Options: yes -Allow Client<->Client: yes -Allow Only These Clients: enable, commonname, 192.168.2.0, 255.255.255.0, push yes -Allow User/Pass Auth: no Firewall Script: (sorry guys, no idea here, just copied) iptables -A FORWARD -i br0 -o tun21 -j ACCEPT Tomato-B -WAN IP: 192.168.0.102 -LAN DHCP: 192.168.2.1-192.168.2.99 -OpenVPN client IP: 10.8.0.6 Client settings -Redirect Internet traffic: yes -Accept DNS configuration: exclusive -Cypher: AES-256-CBC -Compression: Adaptive -Verify server certificate (tls-remote): no Firewall Script: (sorry guys, no idea here, just copied) iptables -A FORWARD -i br0 -o tun11 -j ACCEPT iptables -t nat -I POSTROUTING -s 192.168.1.0/24 -d 192.168.2.0/24 -j SNAT --to $(nvram get lan_ipaddr) What is working? -VPN Internet -When using windows 10, browsing files from Site A on Site B works -Browsing files from B on NAS on lan A works. What's not working yet? -Steam Link -Steam Home streaming -Windows file browsing from B to A My goal is that: All machines on B use the DNS server in router A and only use the internet of router A when VPN is active (when set dynamic DNS on A) All windows machines of A and B can see eachtother (Windows filesharing, steam streaming, steam link) without having to modify the firewalls on the windows machines and other equipment (especially making steam streaming work can be challenging I suppose) Now as far is I have googled this needs a NAT. Then these tutorials are about just setting up a site-to-site VPN, but without the tailored NAT. http://blog.qnology.com/2013/02/tutorial-30-minutes-or-less-site-to.html http://steveit.ca/2017/03/06/setup-site-to-site-vpn-with-2-tomato-routers/ Then this one talks about a NAT setting. I modified it and put it into the execute command field and did afterward nvram commit. After waiting a few minutes I was able to connect from site A to a samba share on windows 10 on site B. B to A was not working. http://www.linksysinfo.org/index.php?threads/site-to-site-vpn.72306/ Then after a reboot of the client router this doenst work anymore untill I do the command again in execute command window: iptables -t nat -I POSTROUTING -s 192.168.1.0/24 -d 192.168.2.0/24 -j SNAT --to $(nvram get lan_ipaddr) And then there is this tutorial: https://www.mcbsys.com/blog/2011/11/set-up-vlan-and-site-to-site-vpn-with-tomato/ So, can anybody please help me to make it happen and to help me understand the layers? What are the right settings for this kind of setup (make shares and steam streaming work)? I have no clue what i typed in the Firewall script, maybe its counteracting?! Is it possible to configure everything in GUI? Can we make it survive a reboot of both routers? Maybe this thread can be the perfect guid to other people planning on setting something similair up. Thanks in advance and kind regards, Joeri P.S. For those people intrested to know the Site-to-Site OpenVPN speed of the R7000 using Shibby 1.40 it is as following: -VPN with QoS enabled: 3,46MB/s -VPN with QoS disabled: 4,15 MB/s -VPN with QoS and LZO compression disabled 4,85MB/s -Regular Internet Transfer speeds using light QoS (no L7 filters) is: 140 Mbs -Regular Internet Transfer speeds using heavy QoS (with L7 filters) is: 110 Mbs -Game server 17ms with QoS and 72ms without QoS with high network loads. I'm using a 250Mbs internet line. CPU load is 56% so I guess the firmware is singlethreded/single core.